Overview of Container Network Exposure

With the addition of Kubernetes services, CNA correlates the data from the VPC configuration (overlay) with the data of the Kubernetes network configuration (underlay) to establish the full path from the internet to the Kubernetes service exposed and the underlying deployment or endpoints associated with the exposed Kubernetes service.

Prisma Cloud Satellite is a lightweight and non-intrusive Kubernetes operator, which enables you to manage other Prisma Cloud applications lifecycle. The Satellite automatically deploys the Discovery application, which is used by Prisma Cloud to ingest Kubernetes artifacts for analysis by CNA. For the container exposure use case, Prisma Cloud correlates the Kubernetes configuration with the VPC network information to determine which Kubernetes components are internet exposed, the deployments and endpoints behind each service, and then builds a network graph to display the network path.

Once Prisma Cloud ingests the assets from both the Kubernetes clusters and cloud accounts, CNA can find the full path from the internet to the service or pod and determine the inbound exposure (internet) by using the following workflow:

• Identify all Kubernetes services in a given cluster.
• Extract the Kubernetes service configuration.
• Map the associated deployment, endpoint, or network security policy with each Kubernetes service.
• Extract the deployment or endpoint configuration.
• Map the Kubernetes cluster and nodes with each Kubernetes service.
• Find the associated load balancer and VPC configuration.
• Calculate if the nodes are internet exposed through the configured protocol and port of the service.
• Attach the underlay configuration (VPC level) with the overlay configuration (Kubernetes level) to determine the end-to-end exposure.

CNA supports only inbound calculation. The data refresh or ingestion occurs once every 24 hours and alerts are near real time. The Kubernetes exposure only evaluates 'LoadBalancer' type Kubernetes services. Other types of Kubernetes service, such as ClusterIP, NodePort, ExternalName, and Headless are not considered for internet exposure evaluation.

Prisma Cloud does not support the following for Container Exposure:

• AWS Classic Load Balancers
• Red Hat Openshift clusters
• Non-Kubernetes based orchestration platforms (AWS ECS, Azure WebApp/Container Instances, GCP Cloud Run)
• Clusters not-onboarded on Prisma Cloud
• On-premises Kubernetes clusters
• Ingress controllers
• Cilium Network Policies